redline | 6fadef11cbfbf357aaf69dde5e95aeac88787d1835ca4234667d3ade0e2ad198

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2023, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tokengen.exe
Size 1.0MB
Sample230520-m9p61aef6s
SHA256 6fadef11cbfbf357aaf69dde5e95aeac88787d1835ca4234667d3ade0e2ad198
MD5 f3468f974f17a906507da387fdbe51fd
SHA1 8439e73465fdbc16fc8ba11f16cef2f8c1626416
SHA512 de93c721f40d361b2bb8d15dcd1d22abb4fae32f16ea50ffb7720bf40ed6cdeb3f900d76e58ef88494bdf27dbca4fe7ee794b53bd9509e45dd49bd7bb9d64cfa
SSDEEP 24576:1yqjg4PbG1MkHwbtLVkzOneUBe3M390UKA5o:QOg4UWtLmzxUBgUKA5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline deren infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

deren

77.91.68.253:19065

Attributes

auth_value
04a169f1fb198bfbeca74d0e06ea2d54

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4768	x8128548.exe
3856	x7162469.exe
1260	f3056649.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x7162469.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tokengen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tokengen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x8128548.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x8128548.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x7162469.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4768	4808	tokengen.exe	79
PID 4808 wrote to memory of 4768	4808	tokengen.exe	79
PID 4808 wrote to memory of 4768	4808	tokengen.exe	79
PID 4768 wrote to memory of 3856	4768	x8128548.exe	80
PID 4768 wrote to memory of 3856	4768	x8128548.exe	80
PID 4768 wrote to memory of 3856	4768	x8128548.exe	80
PID 3856 wrote to memory of 1260	3856	x7162469.exe	81
PID 3856 wrote to memory of 1260	3856	x7162469.exe	81
PID 3856 wrote to memory of 1260	3856	x7162469.exe	81

C:\Users\Admin\AppData\Local\Temp\tokengen.exe
"C:\Users\Admin\AppData\Local\Temp\tokengen.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8128548.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8128548.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7162469.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7162469.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3056649.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3056649.exe
      4⤵
      Executes dropped EXE
      PID:1260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x8128548.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8128548.exe
Size 750KB
SHA256 45193c1a74d5f4aa9f241b7877c44adaa148c277be573d5c4058c0d2599f25c6
MD5 9bfe55f19427eb92ee76bc2c465caf43
SHA1 a626e80d74616a39fa912b863968fd97b44a2f11
SHA512 dc5d343d292c2711fc969547bf0e2cd3092c99803d129ff8949f2687bd37714cf95cd57b0c90e33deb6949633dff29db4d086a64ec27b052f071db79e54c9b73
SSDEEP 12288:7Mrqy90LR04SyG1tl7rHKwHteIJVh60nq8G5gLVdWzKtwbbnDR:JyBfyALeFnuLVdWWWnnV
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8128548.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8128548.exe
Size 750KB
SHA256 45193c1a74d5f4aa9f241b7877c44adaa148c277be573d5c4058c0d2599f25c6
MD5 9bfe55f19427eb92ee76bc2c465caf43
SHA1 a626e80d74616a39fa912b863968fd97b44a2f11
SHA512 dc5d343d292c2711fc969547bf0e2cd3092c99803d129ff8949f2687bd37714cf95cd57b0c90e33deb6949633dff29db4d086a64ec27b052f071db79e54c9b73
SSDEEP 12288:7Mrqy90LR04SyG1tl7rHKwHteIJVh60nq8G5gLVdWzKtwbbnDR:JyBfyALeFnuLVdWWWnnV
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7162469.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7162469.exe
Size 306KB
SHA256 8c3a3e84b0c0e3697ece27d2018d5cfddd41246004e186144bbf8d00fe9c09c9
MD5 78d4f29979c97294dff875ca7686dadd
SHA1 b3a4827cbb63d7fa701655da353276aa6235650e
SHA512 f8648288c43c7ed68a934ced545567c04e75f0a81b12f3833889d8e19d68d26f8b870529c8ee0d366ac8aa8f00095793507fb92bc491c2c148d96b62bf5a4d64
SSDEEP 6144:KSy+bnr+Mfp0yN90QEs6AssBvKwSI4fAanIo0H:aMrYy90DsBvKwIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

x7162469.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7162469.exe
Size 306KB
SHA256 8c3a3e84b0c0e3697ece27d2018d5cfddd41246004e186144bbf8d00fe9c09c9
MD5 78d4f29979c97294dff875ca7686dadd
SHA1 b3a4827cbb63d7fa701655da353276aa6235650e
SHA512 f8648288c43c7ed68a934ced545567c04e75f0a81b12f3833889d8e19d68d26f8b870529c8ee0d366ac8aa8f00095793507fb92bc491c2c148d96b62bf5a4d64
SSDEEP 6144:KSy+bnr+Mfp0yN90QEs6AssBvKwSI4fAanIo0H:aMrYy90DsBvKwIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3056649.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3056649.exe
Size 145KB
SHA256 ee6f216335b133f36a8681aafe7c9cfd7a403c35b38ac404fde9656ccd532c32
MD5 2a450ad2512cbaed16667d5276e47a5d
SHA1 cb499651fdf98e17cd74d0aec46c52f47851f700
SHA512 2c41d087be759d8fc8a6917137801d786ae911d0fa3c57167e920cc6389bae327b54af501684190efb14fe077568810c92031390dd029ccc0c6af60d12bb0562
SSDEEP 3072:FV+m5chQmRSZkJaj+5oxvtXwkXh0Za8e8hM:FjE1GnRXh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3056649.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3056649.exe
Size 145KB
SHA256 ee6f216335b133f36a8681aafe7c9cfd7a403c35b38ac404fde9656ccd532c32
MD5 2a450ad2512cbaed16667d5276e47a5d
SHA1 cb499651fdf98e17cd74d0aec46c52f47851f700
SHA512 2c41d087be759d8fc8a6917137801d786ae911d0fa3c57167e920cc6389bae327b54af501684190efb14fe077568810c92031390dd029ccc0c6af60d12bb0562
SSDEEP 3072:FV+m5chQmRSZkJaj+5oxvtXwkXh0Za8e8hM:FjE1GnRXh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1260-154-0x0000000000180000-0x00000000001AA000-memory.dmp

Download

memory/1260-155-0x00000000050A0000-0x00000000056B8000-memory.dmp

Download

memory/1260-156-0x0000000004C20000-0x0000000004D2A000-memory.dmp

Download

memory/1260-157-0x0000000004B50000-0x0000000004B62000-memory.dmp

Download

memory/1260-158-0x0000000004BB0000-0x0000000004BEC000-memory.dmp

Download

memory/1260-159-0x0000000004C10000-0x0000000004C20000-memory.dmp

Download

memory/1260-160-0x0000000004C10000-0x0000000004C20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads